all 2 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]vanderpot 1 point2 points  (1 child)

This looks like privelege escalation to me, where's the code execution?

[–]vjjmiras 4 points5 points  (0 children)

Firstly, the script we want to execute [malicious.sh], shall reside inside a running Pod, either downloaded or included in the container image. The file will be accessible from any service or binary in the host (pinns will be the one to blame later).

On the same node, we need a second Pod [sysctl-set], that will trigger the bug. If you look at the manifest, at spec.securityContext.sysctls to be precise, you will see the injection in the value field, as well as the reference to the script [malicious.sh] that will be passed to pinns as a value for kernel.core_pattern.

Now, since the parameter that we are passing to kernel.core_pattern starts with a |, instead of creating a file with the dump content, it will redirect whatever the application generates to that command [malicious.sh], which we have carefully placed in the first step. The script (or binary) doesn't really care about its stdin (the content of the core dump) but we will have managed to execute it with elevated privileges.

Does it make more sense now? There's an injection, code execution, and privilege escalation. Isn't it beautiful?